How to Control Who Gets Onto Your Network A Large Systemic Bank s Security Case Study

Transcription

1 How to Control Who Gets Onto Your Network A Large Systemic Bank s Security Case Study Nikos Mourtzinos, CCIE #9763 Cyber Security Sales Specialist, Cisco nmourtzi@cisco.com Algosystems, 4/2018 Christos Stefaneskou, CCIE #43578 ICT Architect, Algosystems xstefan@algosystems.gr

2 Digital transformation is demanding change at an unprecedented pace Mobility Wireless and mobile device traffic will be 66% of total IP traffic by 2020 IoT 26 billion networked devices and connections will exist by 2020 BYOD 95% of global enterprises will have both a CYOD and a formal BYOD plan in place by 2019 Cloud Annual global cloud IP traffic will reach 14.1 ZB by the end of Cisco Security report 2 Cisco Complete VNI Forecast 3 Gartner 4 Cisco Global Cloud Index Whitepaper

3 It s Harder Than Ever to See Who Is on Your Network and What They Are Doing??? 90% of surveyed organizations are And not fully you aware can t of the devices protect 75% what you don t see accessing their network of companies say their mobile devices were targeted by malware in the last 12 months

4 Cisco Identity Services Engine (ISE) Who/What is currently connected on the Network? How Do I Control Who and What Access the Network/Resources? Compliance Insider Threat Once inside, threats can spread quickly How to Quarantine a User or an Endpoint?

5 Cisco Identity Services Engine Where How What Applications When Threats SIEM, MDM, NBA, IPS, IPAM, etc. Who Vulnerabilities Partner Eco System pxgrid and APIs Cisco ISE Business-Relevant Policies Wired Wireless VPN Virtual machine client, IP device, guest, employee, and remote user

6 Authentication, Authorization, Accounting AAA Corporate User Company Asset Guest Registration Required IEEE 802.1x, Easy Connect MAC-Authentication Bypass (MAB) Web Authentication

7 Guest Management

8 Device Profiling Company Asset 1.5 Million Devices with 50 attributes each can be stored Non-User Device 550+ High-level canned profiles. +Periodic feeds Personal Asset Active Probes Device Sensor Netflow DHCP DNS HTTP RADIUS NMAP SNMP CDP LLDP DHCP HTTP H323 SIP MDNS

9 Medical NAC and Internet of Things

10 Posture Assessment Posture defines the state of compliance with the company s security policy Is the system running the current Windows patches? Do you have anti-virus software installed? Is it up to date? Do you have anti-spyware software installed? Is it up to date? Non-compliance, such as MDM or vulnerability can be automatically enforced with a change in access policy Latest Patch? Anti-Virus? USB? Posture Anti-Malware Condition Anti-Spyware Condition Anti-Virus Condition Application Condition Compound Condition Disk Encryption Condition File Condition Patch Management Condition Registry Condition Service Condition USB Condition

11 Application Visibility Continuous Data Monitoring on APP s ISE will report a complete list of running applications and installed applications.

12 PxGrid Industry Adoption Critical Mass 40+ Partner Product Integrations and 12 Technology Areas Net/App Performance IoT Security Firewall and Access Control SIEM and Threat Defense Cisco ISE IAM and SSO Cisco pxgrid Security thru Integration Cisco FirePOWER? Cisco WSA Vulnerability Assessment Packet Capture and Forensics DDI Rapid Threat Containment (RTC) Cloud Access Security pxgrid-enabled ISE Partners: RTC: Cisco FirePower, Bayshore, E8, Elastica, Hawk, Huntsman, Infoblox, Invincea, Lancope, LogRhythm, NetIQ, Rapid7, SAINT, Splunk, Tenable Firewall: Check Point, Infoblox, Bayshore DDI: Infoblox Cloud: Elastica, SkyHigh Networks Net/App: Savvius SIEM/TD: Splunk, Lancope, NetIQ, LogRhythm, FortScale, Rapid7 IAM: Ping, NetIQ, SecureAuth Vulnerability: Rapid7, Tenable, SAINT IoT Security: Bayshore Networks P-Cap/Forensics: Emulex Cisco: WSA, Firesight, Firepower, ISE Other ISE Partners: SIEM/TD: ArcSight, IBM QRadar, Tibco LogLogic, Symantec MDM/EMM: Cisco Meraki, MobileIron, AirWatch, JAMF, SOTI, Symantec, Citrix, IBM, Good, SAP, Tangoe, Globo, Absolute

13 So you can leverage your network to improve security without sacrificing performance Network. Intuitive. Network Visibility Network Segmentation 360 visibility Dynamic control Comprehensive automation Real-time analysis of data and traffic to provide visibility and intelligence across the network Software-defined segmentation for effective and consistent policy application Integrated solutions that augment your capabilities and reduce manual processes

14 Transform your network for the digital era and detect threats faster According to an independent total economic impact study conducted by Forrester According to the 2017 Cisco Annual Cybersecurity Report 80% Lower IT operational costs by avoiding set-up and maintenance costs of traditional bolt-on solutions 98% Improve network agility by reducing the time to implement network changes hours. Boost threat detection by leveraging industry-leading time-to-detection capabilities

15 ISE is a market leader Frost & Sullivan 2016 Best in Class 80% operations savings with ISE & TrustSec* Gartner MQ Leader 3 Years Included in 3 of Gartner Top 10 Information Technologies SC Magazine 2016 & 2017 Best NAC Award

16 Α Large Systemic Bank s Case Study

17 Strengthening Network Access Control in a Large Banking Environment GOALS SOLUTION Secure Wired & Wireless Network Access G1 S X, MAB, Web Authentication, Profiling For thousands endpoints covering HQs & remote buildings Ensure Endpoint Compliance For all Bank s employees, Partners & Guests Achieve Centralized Device Administration G2 G3 G2 G1 S1 S2 S3 S2 S3 Posture Assessment, Cisco AnyConnect & Web Agent Tacacs+ For thousands of Network Devices (routers, firewalls, etc) for all Bank s points of presence in Greece. Ensure Context Visibility G4 G3 G4 S4 S4 Profiling, Reporting See and share user and device details

18 NAC Case Goal 1: Secure Wired and Wireless Network Access Solution: 802.1X, MAB, Web Authentication, Profiling Secure access from any location regardless of connection type Apply access and usage policies across the entire network Monitor access, activity, and compliance of non-corporate assets

19 802.1X NAC Case Goal 1: Secure Bank s Wired and Wireless Network Access Solution: 802.1X, MAB, Web Authentication, Profiling Native Supplicants / Cisco AnyConnect Certificate based Auth Certificate Authorities ENTERPRISE NETWORK SCEP / CRL Passwords / Tokens External Identity Stores THOUSANDS OF ENDPOINTS Active Directory PASSIVE IDENTITY ACTIVE IDENTITY Authentication Methods MAC Authentication Bypass IEEE 802.1X Web Authentication Authorisation Options Downloadable / Named ACL Air Space ACL VLAN Assignment URL-Redirection

20 NAC Case Goal 2: Ensure Endpoint Compliance Solution: Posture Assessment, Cisco Any Connect & Web Agent Posture defines the state of compliance with the company s security policy Posture Flow Antivirus Update AUTHENTICATE USER/DEVICE Posture: Unknown / Non-Compliant? QUARANTINE Limited Access: VLAN / dacl / SGTs Anti-Virus? POSTURE ASSESMENT Check Hotfix, AV, Pin lock, USB Device, etc. REMEDIATION WSUS, Launch App, Scripts, MDM, etc. AUTHORISATION CHANGE Full Access VLAN / dacl / SGTs.

21 NAC Case Goal 3: Achieve Centralized Device Administration Solution: TACACS+ TACACS+ Device Administration Role-based access control Security Admin Team THOUSANDS OF NETWORK DEVICES TACACS+ WorkCenter Benefits Simplified, centralized device administration Increase security, compliancy, auditing for a full range of administration use cases Flexible, granular control Control and audit the configuration of network devices Holistic, centralized visibility Get a comprehensive view of TACACS+ configurations with the TACACS+ administrator work center Capabilities Role-based access control Flow-based user experience Command level authorization with detailed logs for auditing Dedicated TACACS+ workcenter for network administrators Support for core ACS5 features TACACS+ WorkCenter Network Admin Team

22 NAC Case Goal 4: Ensure Context Visibility Solution: Profiling, Reporting, Posturing Poor context awareness Rich context awareness UNKNOWN Without ISE IP ADDRESS: WHO Yiannis (Employee) Unknown WHAT Apple ipad/ios/ Unknown WHEN 10:30 AM PST Unknown WHERE Building XYZ Unknown HOW Wireless Unknown APPS Firefox, MS Word, AnyConnect Unknown SPEC Serial number, CPU, memory KNOWN With ISE Access to any device/user??? RESULT Authorised network access

23 NAC Case Goal 4: Ensure Context Visibility Solution: Profiling, Reporting xxx xxx xxx xxx xxx

24 NAC Banking Case: Business Benefits Asset Visibility Access Control GuestAccess BYOD & enterprise mobility Segmentation See and share user and device details and consolidate security solutions with pxgrid Streamline enterprise network access policy over wired wireless & VPN access Easily provide visitors secure guest internet access Seamlessly classify and securely onboard noncorporate devices Segment network without VLAN and IP subnet. Simplify rolebased access control

25 About Algosystems 31 Years of solid presence in Greece. Active in Greece, Εurope, Africa and the Middle East Offices in Athens, Greece & Doha, Qatar 97 highly specialized, certified and motivated professionals. Dedicated Project Management Team, PMP certified Active in ICT& Business Software, Industrial Automation & Control, ΙοΤ and Metrology solutions Strong and dedicated 24*7 customer support NOC/SOC Team Valuable Gold Partnerships Flexible, trustworthy, quick and reliable problem-solvers!

26 Thank You! Algosystems S.A., 206 Sygrou Avenue, Kallithea (Athens) Tel. (+30) / info@algosystems.gr /